# yayalingo/agent-vuln-loop architecture

> Architecture diagram of the GitHub repository yayalingo/agent-vuln-loop, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/yayalingo/agent-vuln-loop
- Repository: https://github.com/yayalingo/agent-vuln-loop

## Overview

agent-vuln-loop is an authorized security-assessment application. A user starts an engagement through the CLI; the LangGraph pipeline coordinates discovery, hypothesis planning, non-weaponized proof-of-concept descriptions, independent validation (including optional read-only HTTP probes), reporting, and human-gated remediation drafts. The validator can send rejected candidates back for a bounded exploitation retry. Authorization is a shared tool-call gate. The graph preserves documented capabilities whose implementation was not sampled; wiring is shown only where the README or excerpts support it.

Main entry points: [`src/agent_vuln_loop/authorization.py`](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/authorization.py) (Authorization gate), [`src/agent_vuln_loop/agents/validator.py`](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/validator.py) (Validator), [`src/agent_vuln_loop/cli.py`](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/cli.py) (CLI), [`src/agent_vuln_loop/pipeline.py`](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/pipeline.py) (Graph pipeline)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Engagement interface"]
  node_cli["CLI<br/>[cli.py]"]
end

subgraph group_flow["Assessment workflow"]
  node_pipeline["Graph pipeline<br/>[pipeline.py]"]
  node_schema["Engagement state<br/>[schema.py]"]
  node_recon["Recon<br/>[recon.py]"]
  node_planner["Planner<br/>[planner.py]"]
  node_exploit["Exploit descriptions<br/>[exploit.py]"]
end

subgraph group_safety["Safety and evidence"]
  node_validator["Validator<br/>[validator.py]"]
  node_probes["HTTP probes<br/>[probes.py]"]
  node_authorization["Authorization gate<br/>[authorization.py]"]
end

subgraph group_output["Reporting and remediation"]
  node_reporter["Reporter<br/>[reporter.py]"]
  node_remediation["Remediation drafts<br/>[remediation.py]"]
end

node_user(("Operator"))
node_approver(("Human approver"))

node_user -->|"starts engagement"| node_cli
node_cli -->|"invokes graph"| node_pipeline
node_pipeline -->|"coerces state"| node_schema
node_pipeline -->|"dispatches"| node_recon
node_recon -->|"observations"| node_planner
node_planner -->|"hypotheses"| node_exploit
node_exploit -->|"candidate evidence"| node_validator
node_validator -.->|"retries rejected candidates"| node_exploit
node_validator -->|"validated findings"| node_reporter
node_reporter -->|"report and drafts"| node_remediation
node_cli -->|"reads audit trail"| node_authorization
node_recon -->|"checks techniques"| node_authorization
node_planner -->|"checks techniques"| node_authorization
node_exploit -->|"checks techniques"| node_authorization
node_validator -->|"checks techniques"| node_authorization
node_reporter -->|"checks techniques"| node_authorization
node_remediation -->|"checks techniques"| node_authorization
node_validator -->|"runs live checks"| node_probes
node_approver -->|"approves drafts"| node_cli
node_cli -.->|"resumes after approval"| node_pipeline

click node_cli "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/cli.py"
click node_pipeline "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/pipeline.py"
click node_schema "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/schema.py"
click node_recon "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/recon.py"
click node_planner "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/planner.py"
click node_exploit "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/exploit.py"
click node_validator "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/validator.py"
click node_probes "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/probes.py"
click node_authorization "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/authorization.py"
click node_reporter "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/reporter.py"
click node_remediation "https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/remediation.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli toneBlue
class node_pipeline,node_schema,node_recon,node_planner,node_exploit toneAmber
class node_validator,node_probes,node_authorization toneMint
class node_reporter,node_remediation toneRose
class node_user,node_approver toneIndigo
```

## Components

### Engagement interface

- [CLI](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/cli.py): `src/agent_vuln_loop/cli.py`

### Assessment workflow

- [Graph pipeline](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/pipeline.py): `src/agent_vuln_loop/pipeline.py`
- [Engagement state](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/schema.py): `src/agent_vuln_loop/schema.py`
- [Recon](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/recon.py): `src/agent_vuln_loop/agents/recon.py`
- [Planner](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/planner.py): `src/agent_vuln_loop/agents/planner.py`
- [Exploit descriptions](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/exploit.py): `src/agent_vuln_loop/agents/exploit.py`

### Safety and evidence

- [Validator](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/validator.py): `src/agent_vuln_loop/agents/validator.py`
- [HTTP probes](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/probes.py): `src/agent_vuln_loop/probes.py`
- [Authorization gate](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/authorization.py): `src/agent_vuln_loop/authorization.py`

### Reporting and remediation

- [Reporter](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/reporter.py): `src/agent_vuln_loop/agents/reporter.py`
- [Remediation drafts](https://github.com/yayalingo/agent-vuln-loop/blob/main/src/agent_vuln_loop/agents/remediation.py): `src/agent_vuln_loop/agents/remediation.py`

### Other components

- **Operator**
- **Human approver**

## Connections

- Operator → CLI: starts engagement
- CLI → Graph pipeline: invokes graph
- Graph pipeline → Engagement state: coerces state
- Graph pipeline → Recon: dispatches
- Recon → Planner: observations
- Planner → Exploit descriptions: hypotheses
- Exploit descriptions → Validator: candidate evidence
- Validator → Exploit descriptions: retries rejected candidates
- Validator → Reporter: validated findings
- Reporter → Remediation drafts: report and drafts
- CLI → Authorization gate: reads audit trail
- Recon → Authorization gate: checks techniques
- Planner → Authorization gate: checks techniques
- Exploit descriptions → Authorization gate: checks techniques
- Validator → Authorization gate: checks techniques
- Reporter → Authorization gate: checks techniques
- Remediation drafts → Authorization gate: checks techniques
- Validator → HTTP probes: runs live checks
- Human approver → CLI: approves drafts
- CLI → Graph pipeline: resumes after approval